Can anyone suggest a cheatsheet or ToDo list of web site and application security?
A local small business owner prompted a question about web security, basically her company website just got XSS attacked last week. I spent some free time to highlight where she should spend time on fixing in the future. Given that she outsourced her web site, is there a cheatsheet or ToDo list online about web security that I can share with her - i.e. A list of TODO for smart average joe / SMB owner? (Not limited to XSS)